This is the smartphone version of fake pirated media that asks you to download a special desktop "media player" that ends up just being malware. The average user will just accept whatever prompts they are given for free access to wifi. Certificate pinning will be much more important once this becomes mainstream.
On the flip side, certificate pinning prevents an end user from seeing what data an app is transmitting. Standard Man-in-the-Middle solutions like Burp no longer work when an app is cert pinning.
The only way (to my knowledge) to overcome this isto attach a debugger to the app and manually strip the ssl or view the packets prior to being sent.
And that is the very intention.
Both as a user and a software engineer I find this perfectly natural. The app developer could have implemented this himself or just used public-key encryption on top of his HTTPS enabled but not certificate-pinned application.
[1] http://www.chromium.org/Home/chromium-security/security-faq#...
"Rep. Ted Lieu: They could hear any call of pretty much anyone who has a smartphone. It could be stock trades you want someone to execute."
Yeah, you wouldn't want the public to know about the insider gravy train you hopped on when you were elected, huh Ted?
http://www.9jumpin.com.au/show/60minutes/stories/2015/august...
See also "The news is controlled" -- anchors from different stations using the same lines.
https://www.sans.org/reading-room/whitepapers/critical/fall-...
